cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

ÿþOTL logfile created on: 17/02/2016 21:42:50 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\TJ\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.18204)
Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: dd/MM/yyyy

3,87 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 37,30% Memory free
7,75 Gb Paging File | 5,09 Gb Available in Paging File | 65,65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 237,70 Gb Total Space | 178,34 Gb Free Space | 75,02% Space Free | Partition Type: NTFS

Computer Name: TJNOTE200138 | User Name: TJ | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - File not found --
PRC - [2016/02/17 21:38:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\TJ\Downloads\OTL.exe
PRC - [2016/02/09 08:58:39 | 000,748,872 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2016/02/05 22:06:20 | 004,525,520 | ---- | M] (Microsoft Corporation) -- C:\ProgramData\Microsoft\Network\Dsq\network\sysnetwk.exe
PRC - [2016/02/05 15:21:42 | 004,363,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\winsecurity\winsecurity.exe
PRC - [2015/12/13 23:48:02 | 000,082,128 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2015/12/10 10:56:09 | 000,193,456 | ---- | M] () -- C:\Program Files (x86)\SkypeUpdateEx\SkypeUpdateEx.exe
PRC - [2015/12/08 10:24:44 | 007,142,328 | ---- | M] () -- C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\XBox\XBLive.exe
PRC - [2015/10/12 00:56:44 | 000,266,104 | ---- | M] (Navigation Co., Ltd.) -- C:\Users\TJ\AppData\Roaming\ntsvc\ntsvc.exe
PRC - [2015/08/13 10:53:48 | 000,587,576 | ---- | M] (GAS Tecnologia) -- C:\PROGRA~2\GbPlugin\GbpSv.exe
PRC - [2015/04/29 09:21:01 | 000,078,032 | ---- | M] (Absolute Software Corp.) -- C:\Windows\SysWOW64\rpcnet.exe
PRC - [2014/10/08 18:18:56 | 000,211,104 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2014/10/08 18:18:50 | 000,534,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2014/08/13 20:21:38 | 000,059,632 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\HP\ToolboxFX\bin\HPTLBXFX.exe
PRC - [2014/06/27 11:52:26 | 002,088,408 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
PRC - [2014/06/24 10:42:12 | 004,101,576 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
PRC - [2014/04/25 14:12:20 | 000,171,928 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
PRC - [2013/11/12 10:05:45 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PRC - [2013/02/22 07:42:44 | 000,292,088 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
PRC - [2013/01/14 17:29:58 | 000,366,040 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2013/01/14 17:29:58 | 000,279,000 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2013/01/14 17:29:56 | 000,165,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
PRC - [2012/05/30 16:00:02 | 000,013,632 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2012/05/30 16:00:00 | 000,284,480 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2011/12/16 17:17:32 | 000,462,974 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
PRC - [2011/05/25 15:31:18 | 000,223,848 | ---- | M] (O2Micro.) -- c:\Windows\SysWOW64\SDIOAssist.exe
PRC - [2011/05/20 11:27:38 | 000,620,032 | ---- | M] () -- C:\Windows\SysWOW64\GSMSrvEjector.exe
PRC - [2011/05/20 11:27:38 | 000,441,856 | ---- | M] (Lightcomm) -- C:\Program Files (x86)\Oi\Oi3G\GSMCliEjector.exe
PRC - [2010/10/25 14:53:46 | 000,145,920 | ---- | M] (HP) -- C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
PRC - [2003/04/19 00:06:26 | 000,008,192 | ---- | M] () -- c:\Windows\SysWOW64\srvany.exe


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2016/02/17 14:09:23 | 000,489,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\5bd59d72c843099cf2d6e85bdf9772dd\IAStorUtil.ni.dll
MOD - [2016/02/17 14:01:51 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\b7d5535819d1526dd77016fc1f2307b8\System.ServiceProcess.ni.dll
MOD - [2016/02/17 14:01:45 | 011,923,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\c2cdc2efd9bd19e767b83bea57f981f4\System.Web.ni.dll
MOD - [2016/02/17 14:01:41 | 000,774,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\48b76dbabfdec8c358f55380db91414c\System.Runtime.Remoting.ni.dll
MOD - [2016/02/17 14:01:26 | 012,438,016 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\4bd32365cc129932608b1f9f58c60074\System.Windows.Forms.ni.dll
MOD - [2016/02/17 14:01:26 | 000,310,784 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\7f8e76c5817e18659ff1c6e6a0b27ff1\System.Runtime.Serialization.Formatters.Soap.ni.dll
MOD - [2016/02/17 14:01:22 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f2b35eef2f33bff6a31addedf722cc37\System.Drawing.ni.dll
MOD - [2016/02/17 14:01:21 | 001,812,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\90ed80b57941b512ee2e84d6401295b1\System.Deployment.ni.dll
MOD - [2016/02/17 14:01:19 | 005,467,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d6204638b750d650b7cbb3278a5954eb\System.Xml.ni.dll
MOD - [2016/02/17 14:01:17 | 000,978,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\ae206eff0a9816475cd7dd3d680faa48\System.Configuration.ni.dll
MOD - [2016/02/17 14:01:10 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\e7a02f892147a782f5cbcb11b3251844\WindowsBase.ni.dll
MOD - [2016/02/17 14:01:08 | 007,991,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ef80bf7db724bb3ab5fea4c0e2117cae\System.ni.dll
MOD - [2016/02/09 08:58:36 | 016,810,824 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.109\PepperFlash\pepflashplayer.dll
MOD - [2016/02/09 08:58:31 | 001,632,584 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.109\libglesv2.dll
MOD - [2016/02/09 08:58:28 | 000,087,880 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.109\libegl.dll
MOD - [2015/12/30 15:08:10 | 002,771,896 | ---- | M] () -- C:\ProgramData\System32\SafeGuard32.dll
MOD - [2014/09/10 03:11:21 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\eea1bb5d7447f7a6f982afbc0a952ebc\IAStorCommon.ni.dll
MOD - [2014/09/10 03:08:46 | 011,497,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
MOD - [2014/08/13 20:47:12 | 000,120,560 | ---- | M] () -- C:\Program Files (x86)\HP\ToolboxFX\bin\nativeutils.dll
MOD - [2014/05/13 12:04:48 | 000,167,768 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
MOD - [2014/05/13 12:04:46 | 000,109,400 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
MOD - [2014/05/13 12:04:42 | 000,416,600 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
MOD - [2013/09/17 03:33:40 | 000,303,104 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_pt-BR_b77a5c561934e089\mscorlib.resources.dll
MOD - [2013/07/09 03:42:22 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_pt-BR_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2013/07/08 09:42:09 | 000,011,776 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap.resources\2.0.0.0_pt-BR_b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.resources.dll
MOD - [2013/07/08 09:42:06 | 000,393,216 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Deployment.resources\2.0.0.0_pt-BR_b03f5f7f11d50a3a\System.Deployment.resources.dll


[color=#E56717]========== Services (SafeList) ==========[/color]

SRV:[b]64bit:[/b] - [2016/01/22 03:27:40 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:[b]64bit:[/b] - [2015/07/22 21:02:54 | 001,390,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\diagtrack.dll -- (DiagTrack)
SRV:[b]64bit:[/b] - [2012/06/14 08:28:06 | 000,048,128 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE -- (wltrysvc)
SRV:[b]64bit:[/b] - [2011/11/16 16:47:22 | 000,244,328 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Windows\SysNative\o2flash.exe -- (O2FLASH)
SRV:[b]64bit:[/b] - [2009/07/13 22:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2016/02/05 15:21:42 | 004,363,216 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\winsecurity\winsecurity.exe -- (WindowsSecurity)
SRV - [2015/12/13 23:48:02 | 000,082,128 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2015/12/10 10:56:09 | 000,193,456 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\SkypeUpdateEx\SkypeUpdateEx.exe -- (SkypeUpdateEx)
SRV - [2015/12/08 10:24:44 | 007,142,328 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\XBox\XBLive.exe -- (XBox)
SRV - [2015/10/12 00:56:44 | 000,266,104 | ---- | M] (Navigation Co., Ltd.) [Auto | Running] -- C:\Users\TJ\AppData\Roaming\ntsvc\ntsvc.exe -- (Sed)
SRV - [2015/08/13 10:53:48 | 000,587,576 | ---- | M] (GAS Tecnologia) [Auto | Running] -- C:\PROGRA~2\GbPlugin\GbpSv.exe -- (GbpSv)
SRV - [2015/04/30 01:53:40 | 000,366,544 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Arquivos de Programas\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2015/04/30 01:53:40 | 000,023,816 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Arquivos de Programas\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2015/04/29 09:21:01 | 000,078,032 | ---- | M] (Absolute Software Corp.) [Auto | Running] -- C:\Windows\SysWOW64\rpcnet.exe -- (Rpcnet)
SRV - [2014/11/13 23:42:30 | 000,114,288 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014/10/08 18:18:56 | 000,211,104 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2014/10/08 18:18:50 | 000,534,184 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2014/04/11 23:08:08 | 000,103,608 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2014/03/20 19:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2013/03/11 12:05:06 | 000,231,792 | ---- | M] () [Auto | Running] -- C:\Arquivos de Programas\Dell\Dell Data Protection\Access\Advanced\Wave\EMBASSY Client Core\EmbassyServer.exe -- (EmbassyService)
SRV - [2013/03/08 14:13:56 | 000,254,824 | ---- | M] (Wave Systems Corp.) [Auto | Stopped] -- C:\Arquivos de Programas\Dell\Dell Data Protection\Access\Advanced\Wave\Common\WvPCR.exe -- (WvPCR)
SRV - [2013/03/05 16:31:54 | 005,159,760 | ---- | M] (Wave Systems Corp.) [Auto | Running] -- C:\Arquivos de Programas\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe -- (TdmService)
SRV - [2013/02/26 17:17:16 | 001,773,056 | ---- | M] (Wave Systems Corp.) [Auto | Running] -- C:\Arquivos de Programas\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe -- (Wave Authentication Manager Service)
SRV - [2013/02/05 08:59:48 | 000,332,800 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Arquivos de Programas\IDT\WDM\stacsv64.exe -- (STacSV)
SRV - [2013/02/01 16:21:52 | 002,215,272 | ---- | M] (Wave Systems Corp.) [On_Demand | Stopped] -- C:\Arquivos de Programas\Dell\Dell Data Protection\Access\Advanced\Wave\Secure Storage Manager\SecureStorageService.exe -- (SecureStorageService)
SRV - [2013/01/21 14:05:12 | 000,021,504 | ---- | M] (Dell, Inc.) [Auto | Running] -- C:\Arquivos de Programas\Dell\Dell Data Protection\Access\Advanced\hapi64\pbadrvsvc.exe -- (PbaDrvSvc_x64)
SRV - [2013/01/14 17:29:58 | 000,366,040 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2013/01/14 17:29:58 | 000,279,000 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2013/01/14 17:29:56 | 000,165,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe -- (jhi_service)
SRV - [2012/12/10 16:31:44 | 000,803,872 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Arquivos de Programas\Intel\iCLS Client\SocketHeciServer.exe -- (Intel(R)
SRV - [2012/12/10 16:31:28 | 000,732,160 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Arquivos de Programas\Intel\iCLS Client\HeciServer.exe -- (Intel(R)
SRV - [2012/08/15 18:38:04 | 002,280,504 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Arquivos de Programas\Dell\Feature Enhancement Pack\DFEPService.exe -- (DFEPService)
SRV - [2012/07/17 17:14:44 | 002,292,480 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Arquivos de Programas\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2012/06/20 07:13:36 | 000,276,288 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)
SRV - [2012/05/30 16:00:02 | 000,013,632 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2012/05/11 11:42:24 | 001,643,520 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Security Innovation\SI TSS\bin\tcsd_win32.exe -- (tcsd_win32.exe)
SRV - [2012/02/22 15:09:52 | 000,945,440 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Arquivos de Programas\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2011/05/20 11:27:38 | 000,620,032 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\GSMSrvEjector.exe -- (GSMEjector)
SRV - [2011/04/05 19:07:38 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Arquivos de Programas\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010/10/25 14:53:46 | 000,145,920 | ---- | M] (HP) [Auto | Running] -- C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe -- (HP LaserJet Service)
SRV - [2003/04/19 00:06:26 | 000,008,192 | ---- | M] () [Auto | Running] -- c:\Windows\SysWOW64\srvany.exe -- (O2SDIOAssist)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV:[b]64bit:[/b] - [2015/04/30 04:53:58 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{560ee3fd-9654-4ad9-9a90-e7be99f5b3c7}w64.sys -- ({560ee3fd-9654-4ad9-9a90-e7be99f5b3c7}w64)
DRV:[b]64bit:[/b] - [2015/04/29 03:02:46 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{1cd3f706-5219-4089-9f86-6d8cc40aacac}w64.sys -- ({1cd3f706-5219-4089-9f86-6d8cc40aacac}w64)
DRV:[b]64bit:[/b] - [2015/04/22 01:53:52 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{83d61599-0efb-4f42-943e-3fde87e711f5}w64.sys -- ({83d61599-0efb-4f42-943e-3fde87e711f5}w64)
DRV:[b]64bit:[/b] - [2015/04/18 07:00:16 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{4d764ff2-b4ed-464e-844f-8a1fbea806f0}w64.sys -- ({4d764ff2-b4ed-464e-844f-8a1fbea806f0}w64)
DRV:[b]64bit:[/b] - [2015/04/10 03:31:56 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{5ba6553b-6340-4c7d-bf54-0c684c734bbb}w64.sys -- ({5ba6553b-6340-4c7d-bf54-0c684c734bbb}w64)
DRV:[b]64bit:[/b] - [2015/03/24 20:24:52 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{77f6a904-58d8-47e1-b07f-da8c7e56f35d}w64.sys -- ({77f6a904-58d8-47e1-b07f-da8c7e56f35d}w64)
DRV:[b]64bit:[/b] - [2015/03/23 18:28:56 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{62469e06-7e58-4462-b250-e2bdf049adec}w64.sys -- ({62469e06-7e58-4462-b250-e2bdf049adec}w64)
DRV:[b]64bit:[/b] - [2015/03/18 06:22:42 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{155269df-e342-42e1-af8a-a92196148922}w64.sys -- ({155269df-e342-42e1-af8a-a92196148922}w64)
DRV:[b]64bit:[/b] - [2015/03/13 06:18:52 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{15005ce0-4adb-4842-9f2a-405172e87bce}w64.sys -- ({15005ce0-4adb-4842-9f2a-405172e87bce}w64)
DRV:[b]64bit:[/b] - [2015/03/06 04:19:20 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{3c4fd987-a31c-4e2b-a0ae-9209b42926d2}w64.sys -- ({3c4fd987-a31c-4e2b-a0ae-9209b42926d2}w64)
DRV:[b]64bit:[/b] - [2015/03/04 19:34:52 | 000,124,568 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:[b]64bit:[/b] - [2015/03/03 11:18:36 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{439426a3-319f-4595-8446-0791284f3711}w64.sys -- ({439426a3-319f-4595-8446-0791284f3711}w64)
DRV:[b]64bit:[/b] - [2015/03/01 07:16:36 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{ca032d0a-a16a-4ca5-8bc6-c3c5a2d19d37}w64.sys -- ({ca032d0a-a16a-4ca5-8bc6-c3c5a2d19d37}w64)
DRV:[b]64bit:[/b] - [2015/02/24 22:20:50 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{62eca849-70b6-47ed-932e-18163afa5bee}w64.sys -- ({62eca849-70b6-47ed-932e-18163afa5bee}w64)
DRV:[b]64bit:[/b] - [2015/02/23 07:42:20 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{f3daddfc-782d-4450-a020-ed3b44858e01}w64.sys -- ({f3daddfc-782d-4450-a020-ed3b44858e01}w64)
DRV:[b]64bit:[/b] - [2015/02/21 02:28:10 | 000,048,792 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{3cee21b8-f45f-4b81-8601-1f2cae0a9621}Gw64.sys -- ({3cee21b8-f45f-4b81-8601-1f2cae0a9621}Gw64)
DRV:[b]64bit:[/b] - [2014/10/08 18:18:56 | 000,023,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvolwin7.sys -- (Sftvol)
DRV:[b]64bit:[/b] - [2014/10/08 18:18:54 | 000,029,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirwin7.sys -- (Sftredir)
DRV:[b]64bit:[/b] - [2014/10/08 18:18:52 | 000,273,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaywin7.sys -- (Sftplay)
DRV:[b]64bit:[/b] - [2014/10/08 18:18:50 | 000,767,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfswin7.sys -- (Sftfs)
DRV:[b]64bit:[/b] - [2013/10/01 23:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:[b]64bit:[/b] - [2013/09/17 03:33:59 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2013/09/17 03:33:54 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2013/09/17 03:33:54 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2013/09/16 23:50:59 | 000,085,848 | ---- | M] (O2Micro) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\oz776x64.sys -- (guardian2)
DRV:[b]64bit:[/b] - [2013/09/16 23:49:10 | 000,135,720 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcbtums.sys -- (bcbtums)
DRV:[b]64bit:[/b] - [2013/09/16 23:49:09 | 000,615,464 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (btwampfl)
DRV:[b]64bit:[/b] - [2013/09/16 23:49:09 | 000,211,496 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:[b]64bit:[/b] - [2013/09/16 23:49:09 | 000,184,360 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:[b]64bit:[/b] - [2013/09/16 23:49:09 | 000,039,976 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:[b]64bit:[/b] - [2013/09/16 23:49:09 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:[b]64bit:[/b] - [2013/02/22 07:40:14 | 000,792,560 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3xhc.sys -- (iusb3xhc)
DRV:[b]64bit:[/b] - [2013/02/22 07:40:14 | 000,358,896 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3hub.sys -- (iusb3hub)
DRV:[b]64bit:[/b] - [2013/02/22 07:40:14 | 000,020,464 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iusb3hcs.sys -- (iusb3hcs)
DRV:[b]64bit:[/b] - [2013/02/21 18:10:12 | 000,489,264 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)
DRV:[b]64bit:[/b] - [2013/02/05 08:59:48 | 000,544,768 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:[b]64bit:[/b] - [2012/09/23 05:18:58 | 000,039,016 | ---- | M] (Dell Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dcdbas64.sys -- (dcdbas)
DRV:[b]64bit:[/b] - [2012/09/12 17:20:04 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:[b]64bit:[/b] - [2012/08/23 11:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:[b]64bit:[/b] - [2012/08/23 11:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:[b]64bit:[/b] - [2012/08/17 12:10:20 | 001,109,296 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATSwpWDF.sys -- (ATSwpWDF)
DRV:[b]64bit:[/b] - [2012/08/10 21:44:18 | 000,482,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress)
DRV:[b]64bit:[/b] - [2012/07/13 02:56:32 | 000,062,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:[b]64bit:[/b] - [2012/06/14 08:28:06 | 000,022,632 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcm42rly.sys -- (BCM42RLY)
DRV:[b]64bit:[/b] - [2012/06/14 08:27:50 | 004,746,304 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:[b]64bit:[/b] - [2012/06/07 03:49:06 | 014,760,096 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:[b]64bit:[/b] - [2012/05/30 18:42:10 | 000,569,152 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:[b]64bit:[/b] - [2012/04/26 23:20:48 | 000,085,336 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\o2sdjw7x64.sys -- (O2SDJRDR)
DRV:[b]64bit:[/b] - [2011/12/06 10:23:08 | 000,331,264 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:[b]64bit:[/b] - [2011/05/27 11:22:28 | 000,138,240 | ---- | M] (Olivetti) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Olicard155Usbnet.sys -- (Olicard155net)
DRV:[b]64bit:[/b] - [2011/05/27 11:22:28 | 000,119,680 | ---- | M] (Olivetti) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\jrdusbser.sys -- (jrdusbser)
DRV:[b]64bit:[/b] - [2011/01/03 19:19:56 | 000,074,984 | ---- | M] (O2Micro ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\O2MDRw7x64.sys -- (O2MDRRDR)
DRV:[b]64bit:[/b] - [2011/01/03 17:04:44 | 000,072,808 | ---- | M] (O2Micro ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\o2mdfw7x64.sys -- (O2MDFRDR)
DRV:[b]64bit:[/b] - [2010/11/21 00:23:48 | 000,168,448 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netvsc60.sys -- (netvsc)
DRV:[b]64bit:[/b] - [2010/11/21 00:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:[b]64bit:[/b] - [2010/11/21 00:23:48 | 000,022,528 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VMBusVideoM.sys -- (SynthVid)
DRV:[b]64bit:[/b] - [2010/11/21 00:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2010/09/10 19:22:16 | 000,176,096 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:[b]64bit:[/b] - [2009/07/13 22:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009/07/13 22:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009/07/13 22:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009/07/13 21:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:[b]64bit:[/b] - [2009/06/10 17:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009/06/10 17:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009/06/10 17:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009/06/10 17:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2016/02/17 13:42:14 | 000,016,984 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\DelYAC_x64.sys -- (egg_protect)
DRV - [2015/09/03 15:41:02 | 000,029,912 | ---- | M] (GAS Tecnologia) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\GbPlugin\gbprcm64.sys -- (GBPRCM)
DRV - [2014/09/02 09:31:52 | 000,024,792 | ---- | M] (GAS Tecnologia LTDA) [Kernel | On_Demand | Running] -- C:\PROGRA~2\GbPlugin\wsftprp64.sys -- (Warsaw_PP)
DRV - [2009/07/13 22:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.searchult.com/?bd=ds&oem=clckmn&uid=SAMSUNGXSSDXPM830XmSATAX256GB_S0XPNYAD606335606335&version=2.3.0.8956&pid=414031160&tid=463&q={searchTerms}
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.searchult.com/?bd=ds&oem=clckmn&uid=SAMSUNGXSSDXPM830XmSATAX256GB_S0XPNYAD606335606335&version=2.3.0.8956&pid=414031160&tid=463&q={searchTerms}
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages =
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {E921F400-D383-4B1B-9DE6-FCFCACFC1173}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{589B893E-773C-4941-88C2-0DCC718E621C}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=DCJB
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{66BA0BE6-FEEA-4645-BA60-B5EC8BC590CC}: "URL" = http://Taplika.com/results.php?f=4&q={searchTerms}&a=tpl_tuto_15_03&cd=2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FyEtCyBtDzy0D0DtCzzzztN0D0Tzu0StCtCtCtBtN1L2XzutAtFyCtFyCtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StD0AyEyDtAyEtB0BtG0CyByEtDtG0ByEzytCtGzy0F0E0DtGtAtAyBtByE0B0BzytA0CtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtD0CtByDtC0C0CtG0A0F0AyDtGyE0EtD0CtGzz0ByDtDtGyEtC0EtDyCyDtCzy0AyE0Czz2Q&cr=1215094555&ir=
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{CC865B26-C31D-4D23-B17B-96548EEF03F6}: "URL" = http://isearch.omiga-plus.com/web/?type=ds&ts=1417199671&from=slbnew&uid=SAMSUNGXSSDXPM830XmSATAX256GB_S0XPNYAD606335606335&q={searchTerms}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{E921F400-D383-4B1B-9DE6-FCFCACFC1173}: "URL" = http://search.searchult.com/?bd=ds&oem=clckmn&uid=SAMSUNGXSSDXPM830XmSATAX256GB_S0XPNYAD606335606335&version=2.3.0.8956&pid=414031160&tid=463&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchtudo.com/pt/?uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.navegaki.com?q={searchTerms}&uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.navegaki.com?q={searchTerms}&uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchtudo.com/pt/?uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg
IE - HKLM\..\SearchScopes,DefaultScope = {E921F400-D383-4B1B-9DE6-FCFCACFC1173}
IE - HKLM\..\SearchScopes\{66BA0BE6-FEEA-4645-BA60-B5EC8BC590CC}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=DCJB
IE - HKLM\..\SearchScopes\{E921F400-D383-4B1B-9DE6-FCFCACFC1173}: "URL" = http://search.navegaki.com?q={searchTerms}&uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchtudo.com/pt/?uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.navegaki.com?q={searchTerms}&uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.navegaki.com?q={searchTerms}&uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchtudo.com/pt/?uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchtudo.com/pt/?uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.navegaki.com?q={searchTerms}&uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.navegaki.com?q={searchTerms}&uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchtudo.com/pt/?uid={9c6ab40cc4064a14807ed92b3334525a}&r=eg
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = ?uid={9c6ab40cc4064a14807ed92b3334525a}&r=
IE - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = ?q={searchTerms}&uid={9c6ab40cc4064a14807ed92b3334525a}&r=
IE - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = ?q={searchTerms}&uid={9c6ab40cc4064a14807ed92b3334525a}&r=
IE - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
IE - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..\SearchScopes,DefaultScope = {66BA0BE6-FEEA-4645-BA60-B5EC8BC590CC}
IE - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
IE - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..\SearchScopes\{66BA0BE6-FEEA-4645-BA60-B5EC8BC590CC}: "URL" = http://searchsimple-a.akamaihd.net/?affID=pr_44ed7d65-172f-45cf-afbf-85f940e5da4f&q={searchTerms}
IE - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..\SearchScopes\{E921F400-D383-4B1B-9DE6-FCFCACFC1173}: "URL" = ?q={searchTerms}&uid={9c6ab40cc4064a14807ed92b3334525a}&r=
IE - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8080;https=127.0.0.1:8080

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "https://www.mozilla.org/pt-BR/firefox/central/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:33.1.1
FF - prefs.js..keyword.URL: "http://br.search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=pr__alt__ddc_dss_bd_com&p="
FF - prefs.js..network.proxy.backup.ftp: ""
FF - prefs.js..network.proxy.backup.ftp_port: 0
FF - prefs.js..network.proxy.backup.socks: ""
FF - prefs.js..network.proxy.backup.socks_port: 0
FF - prefs.js..network.proxy.backup.ssl: ""
FF - prefs.js..network.proxy.backup.ssl_port: 0
FF - prefs.js..network.proxy.ftp: "10.254.0.254"
FF - prefs.js..network.proxy.ftp_port: 3128
FF - prefs.js..network.proxy.http: "10.254.0.254"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "10.254.0.254"
FF - prefs.js..network.proxy.socks_port: 3128
FF - prefs.js..network.proxy.ssl: "10.254.0.254"
FF - prefs.js..network.proxy.ssl_port: 3128


FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\gastecnologia.com.br/sf/cef: C:\Users\TJ\AppData\Local\GAS Tecnologia\GBBD\npsf_cef.dll (GAS Tecnologia)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 33.1.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 33.1.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{87F8774F-B485-47E2-A755-A40A8A5E886D}: C:\Users\TJ\AppData\Local\GAS Tecnologia\GBBD\cef\xpi [2014/07/16 18:53:25 | 000,000,000 | ---D | M]

[2013/11/12 10:05:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TJ\AppData\Roaming\mozilla\Extensions
[2015/12/21 17:46:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TJ\AppData\Roaming\mozilla\Firefox\Profiles\w9kcb9z9.default\extensions
[2015/12/19 13:08:53 | 000,000,592 | ---- | M] () -- C:\Users\TJ\AppData\Roaming\mozilla\firefox\profiles\w9kcb9z9.default\searchplugins\.xml
[2015/05/28 08:16:37 | 000,001,160 | ---- | M] () -- C:\Users\TJ\AppData\Roaming\mozilla\firefox\profiles\w9kcb9z9.default\searchplugins\dsrlte1.xml
[2014/12/01 10:22:25 | 000,002,854 | ---- | M] () -- C:\Users\TJ\AppData\Roaming\mozilla\firefox\profiles\w9kcb9z9.default\searchplugins\Groovorio.xml
[2015/12/19 12:20:10 | 000,000,674 | ---- | M] () -- C:\Users\TJ\AppData\Roaming\mozilla\firefox\profiles\w9kcb9z9.default\searchplugins\navegaki.xml
[2015/05/28 08:17:45 | 000,001,218 | ---- | M] () -- C:\Users\TJ\AppData\Roaming\mozilla\firefox\profiles\w9kcb9z9.default\searchplugins\search-simple.xml
[2015/01/30 18:39:10 | 000,002,776 | ---- | M] () -- C:\Users\TJ\AppData\Roaming\mozilla\firefox\profiles\w9kcb9z9.default\searchplugins\Taplika.xml
[2014/12/01 10:22:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2014/12/01 10:22:06 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[color=#E56717]========== Chrome ==========[/color]

CHR - Extension: No name found = C:\Users\TJ\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\
CHR - Extension: No name found = C:\Users\TJ\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\
CHR - Extension: No name found = C:\Users\TJ\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\
CHR - Extension: No name found = C:\Users\TJ\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\
CHR - Extension: No name found = C:\Users\TJ\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.60_0\
CHR - Extension: No name found = C:\Users\TJ\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\
CHR - Extension: No name found = C:\Users\TJ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.1_0\
CHR - Extension: No name found = C:\Users\TJ\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.1.0_0\
CHR - Extension: No name found = C:\Users\TJ\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\

O1 HOSTS File: ([2016/02/17 20:59:53 | 000,450,831 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 15473 more lines...
O2 - BHO: (GbIehObj Class) - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Program Files (x86)\GbPlugin\gbiehcef.dll (Caixa Economica Federal)
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:[b]64bit:[/b] - HKLM..\Run: [Apoint] C:\Arquivos de Programas\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4:[b]64bit:[/b] - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Arquivos de Programas\Dell\DW WLAN Card\WLTRAY.EXE (Dell Inc.)
O4:[b]64bit:[/b] - HKLM..\Run: [DFEPApplication] C:\Arquivos de Programas\Dell\Feature Enhancement Pack\DFEPApplication.exe (Dell Inc.)
O4:[b]64bit:[/b] - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [HP LaserJet Professional M1530 MFP Series Fax] C:\Program Files (x86)\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe (Hewlett-Packard Company)
O4:[b]64bit:[/b] - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [SysTrayApp] C:\Arquivos de Programas\IDT\WDM\sttray64.exe (IDT, Inc.)
O4:[b]64bit:[/b] - HKLM..\Run: [TdmNotify] C:\Arquivos de Programas\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [gmsd_br_5] File not found
O4 - HKLM..\Run: [gmsd_br_535] File not found
O4 - HKLM..\Run: [gmsd_br_535b] File not found
O4 - HKLM..\Run: [GSMEjector] C:\Program Files (x86)\Oi\Oi3G\GSMCliEjector.exe (Lightcomm)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe (Intel Corporation)
O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [ToolboxFX] C:\Program Files (x86)\HP\ToolboxFX\bin\HPTLBXFX.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
O4 - HKU\S-1-5-21-977384624-3897332769-3740275614-1001..\Run: [CCleaner Monitoring] C:\Program Files\CCleaner\CCleaner64.exe (Piriform Ltd)
O4 - Startup: C:\Users\Administrador\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk = File not found
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk = File not found
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk = File not found
O4 - Startup: C:\Users\SUPORTE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk = File not found
O4 - Startup: C:\Users\Usuário Padrão\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O7 - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Arquivos de Programas\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Arquivos de Programas\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\ProgramData\System32\SafeGuard64.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\ProgramData\System32\SafeGuard32.dll ()
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..Trusted Domains: caixa.gov.br ([imagem] * in Trusted sites)
O15 - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..Trusted Domains: caixa.gov.br ([imagem] https in Trusted sites)
O15 - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..Trusted Domains: caixa.gov.br ([imagem2] https in Trusted sites)
O15 - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..Trusted Domains: caixa.gov.br ([internetbanking] * in Trusted sites)
O15 - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..Trusted Domains: caixa.gov.br ([internetbanking] https in Trusted sites)
O15 - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..Trusted Domains: caixa.gov.br ([internetbankingpf] * in Trusted sites)
O15 - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..Trusted Domains: caixa.gov.br ([internetbankingpf] https in Trusted sites)
O15 - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..Trusted Domains: caixa.gov.br ([www] * in Trusted sites)
O15 - HKU\S-1-5-21-977384624-3897332769-3740275614-1001\..Trusted Domains: caixa.gov.br ([www] http in Trusted sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{186C30B2-B781-4936-89D6-C09C79A09A61}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{706FF04C-1EA3-4801-A722-E8F01340338F}: DhcpNameServer = 192.168.0.1
O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\wlpg - No CLSID value found
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:[b]64bit:[/b] - Winlogon\Notify\spba: DllName - (C:\Program Files\Common Files\SPBA\homefus2.dll) - C:\Arquivos de Programas\Common Files\SPBA\homefus2.dll (Authentec Inc.)
O20 - Winlogon\Notify\ GbPluginCef: DllName - (C:\Program Files (x86)\GbPlugin\gbiehCef.dll) - C:\Program Files (x86)\GbPlugin\gbiehCef.dll (Caixa Economica Federal)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {E37CB5F0-51F5-4395-A808-5FA49E399003} - C:\Program Files (x86)\GbPlugin\gbiehcef.dll (Caixa Economica Federal)
O30:[b]64bit:[/b] - LSA: Authentication Packages - (wvauth) - C:\Windows\SysNative\wvauth.dll (Wave Systems Corp.)
O30 - LSA: Authentication Packages - (wvauth) - File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{9e856296-4c25-11e4-9169-b00594f5f40f}\Shell - "" = AutoRun
O33 - MountPoints2\{9e856296-4c25-11e4-9169-b00594f5f40f}\Shell\AutoRun\command - "" = D:\Autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2016/02/17 20:45:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2016/02/17 20:44:57 | 000,021,040 | ---- | C] (Safer Networking Limited) -- C:\Windows\SysNative\sdnclean64.exe
[2016/01/29 23:44:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Package Cache
[2 C:\Users\TJ\AppData\Local\*.tmp files -> C:\Users\TJ\AppData\Local\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2016/02/17 21:25:56 | 000,000,502 | RHS- | M] () -- C:\Users\TJ\ntuser.pol
[2016/02/17 20:59:53 | 000,450,831 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2016/02/17 20:59:32 | 000,450,831 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20160217-205953.backup
[2016/02/17 20:51:01 | 000,001,070 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2016/02/17 20:45:05 | 000,001,381 | ---- | M] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2016/02/17 20:32:59 | 000,031,312 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2016/02/17 20:32:59 | 000,031,312 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2016/02/17 20:27:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2016/02/17 20:27:30 | 000,017,408 | ---- | M] () -- C:\Windows\SysNative\rpcnetp.exe
[2016/02/17 14:29:38 | 001,636,114 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2016/02/17 14:29:38 | 000,706,136 | ---- | M] () -- C:\Windows\SysNative\prfh0416.dat
[2016/02/17 14:29:38 | 000,654,592 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2016/02/17 14:29:38 | 000,147,718 | ---- | M] () -- C:\Windows\SysNative\prfc0416.dat
[2016/02/17 14:29:38 | 000,122,206 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2016/02/17 14:24:27 | 000,001,066 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2016/02/17 14:24:26 | 000,000,034 | ---- | M] () -- C:\Users\Public\Documents\{DE764086-1C0A-4DD3-90BA-0B93BDD794BE}
[2016/02/17 14:23:30 | 000,078,032 | ---- | M] (Absolute Software Corp.) -- C:\Windows\SysWow64\rpcnet.dll
[2016/02/17 14:23:30 | 000,017,408 | ---- | M] () -- C:\Windows\SysWow64\rpcnetp.dll
[2016/02/17 14:23:21 | 3120,254,976 | -HS- | M] () -- C:\hiberfil.sys
[2016/02/17 14:23:21 | 000,017,408 | ---- | M] () -- C:\Windows\SysWow64\rpcnetp.exe
[2016/02/17 14:19:34 | 000,012,012 | ---- | M] () -- C:\Users\TJ\Desktop\ORÇAMENTO 2016.ods
[2016/02/17 13:57:28 | 000,315,712 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2016/02/17 13:50:48 | 000,000,148 | RHS- | M] () -- C:\ProgramData\3002.xml
[2016/02/17 13:50:44 | 000,032,000 | RHS- | M] () -- C:\ProgramData\3002.abs
[2016/02/17 13:42:14 | 000,016,984 | ---- | M] () -- C:\Windows\DelYAC_x64.sys
[2016/02/10 19:30:22 | 000,002,331 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2016/02/05 22:06:45 | 000,001,121 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2 C:\Users\TJ\AppData\Local\*.tmp files -> C:\Users\TJ\AppData\Local\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2016/02/17 21:25:56 | 000,000,502 | RHS- | C] () -- C:\Users\TJ\ntuser.pol
[2016/02/17 20:45:05 | 000,001,393 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2016/02/17 20:45:05 | 000,001,381 | ---- | C] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2016/02/17 13:42:14 | 000,016,984 | ---- | C] () -- C:\Windows\DelYAC_x64.sys
[2015/12/07 11:17:50 | 000,015,464 | ---- | C] () -- C:\Windows\DelYac64.sys
[2015/05/31 17:38:47 | 000,000,085 | ---- | C] () -- C:\Windows\wininit.ini
[2015/05/29 09:26:49 | 000,000,000 | ---- | C] () -- C:\Users\TJ\AppData\Local\Temp.dat
[2015/05/06 09:15:06 | 000,015,568 | RHS- | C] () -- C:\ProgramData\3029.abs
[2015/04/30 11:08:40 | 000,000,176 | ---- | C] () -- C:\Windows\REC-NET.INI
[2015/04/20 11:05:14 | 001,246,720 | ---- | C] () -- C:\Users\TJ\AppData\Roaming\wnuS9SmS7D2aCBwDU9F7ImsJuDR.exe
[2015/04/20 11:05:14 | 001,246,720 | ---- | C] () -- C:\Users\TJ\AppData\Roaming\cv4SB56OWK.exe
[2015/04/14 13:28:56 | 000,001,171 | ---- | C] () -- C:\Users\TJ\AppData\Roaming\wnuS9SmS7D2aCBwDU9F7ImsJuDR
[2015/04/14 13:28:56 | 000,001,171 | ---- | C] () -- C:\Users\TJ\AppData\Roaming\cv4SB56OWK
[2014/12/01 10:08:05 | 000,000,227 | ---- | C] () -- C:\ProgramData\bc.ini
[2014/12/01 10:07:46 | 000,000,000 | ---- | C] () -- C:\Users\TJ\AppData\Roaming\AbsoluteReminder.xml
[2014/11/28 15:35:55 | 000,002,313 | ---- | C] () -- C:\Windows\patsearch.bin
[2014/10/30 08:56:22 | 000,620,032 | ---- | C] () -- C:\Windows\SysWow64\GSMSrvEjector.exe
[2014/04/05 11:17:47 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2014/02/01 10:53:05 | 000,730,322 | ---- | C] () -- C:\Users\TJ\AppData\Roaming\unins000.exe
[2014/02/01 10:53:05 | 000,016,979 | ---- | C] () -- C:\Users\TJ\AppData\Roaming\unins000.dat
[2014/01/10 08:58:15 | 005,419,008 | ---- | C] () -- C:\Users\TJ\lj1020_1022-HB-pnp-win32-pr_win2000_XP_Vista.exe
[2013/11/20 12:07:33 | 000,000,148 | RHS- | C] () -- C:\ProgramData\3002.xml
[2013/11/20 12:07:30 | 000,032,000 | RHS- | C] () -- C:\ProgramData\3002.abs
[2013/09/16 23:51:09 | 000,001,956 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[color=#E56717]========== ZeroAccess Check ==========[/color]

[2009/07/14 01:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2016/01/22 03:19:58 | 014,179,840 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2016/01/22 03:05:58 | 012,877,824 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 22:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 00:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 22:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

[color=#E56717]========== Purity Check ==========[/color]



[color=#E56717]========== Custom Scans ==========[/color]

[color=#A23BEC]< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections >[/color]
"DefaultConnectionSettings" = 46 00 00 00 4C 11 00 00 03 00 00 00 28 00 00 00 68 74 74 70 3D 31 32 37 2E 30 2E 30 2E 31 3A 38 30 38 30 3B 68 74 74 70 73 3D 31 32 37 2E 30 2E 30 2E 31 3A 38 30 38 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 01 0B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [Binary data over 200 bytes]
"SavedLegacySettings" = 46 00 00 00 2D 0E 00 00 03 00 00 00 28 00 00 00 68 74 74 70 3D 31 32 37 2E 30 2E 30 2E 31 3A 38 30 38 30 3B 68 74 74 70 73 3D 31 32 37 2E 30 2E 30 2E 31 3A 38 30 38 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 01 0B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [Binary data over 200 bytes]
"Oi 3G" = 46 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [binary data]

[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 10 bytes -> C:\Program Files (x86)\GbPlugin:IncompleteStartProcessProtection.cnt

< End of report >

Publicité


Signaler le contenu de ce document

Publicité